CVE-2026-84304
published 2026-09-01CVE-2026-84304: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate…
PriorityP353high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.61%
48.8th percentile
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| advanced-cluster-security | rhacs-rhel9-operator | — | — |
| advanced-cluster-security | rhacs-scanner-slim-rhel9 | — | — |
| advanced-cluster-security | rhacs-scanner-v4-rhel9 | — | — |
| cert-manager | cert-manager-operator-rhel9 | — | — |
| cert-manager | jetstack-cert-manager-rhel9 | — | — |
| google.golang.org | grpc | >= 0 < 1.83.1 | 1.83.1 |
| grpc | grpc-go | < 1.83.1 | 1.83.1 |
| multicluster-engine | addon-manager-rhel9 | — | — |
| multicluster-engine | assisted-service-9-rhel9 | — | — |
| multicluster-engine | kube-rbac-proxy-mce-rhel9 | — | — |
| multicluster-engine | managedcluster-import-controller-rhel9 | — | — |
| multicluster-engine | multicloud-manager-rhel9 | — | — |
| multicluster-engine | placement-rhel9 | — | — |
| multicluster-engine | registration-operator-rhel9 | — | — |
| multicluster-engine | registration-rhel9 | — | — |
| multicluster-engine | work-rhel9 | — | — |
| openshift-logging | cluster-logging-rhel9-operator | — | — |
| openshift-pipelines | pipelines-chains-controller-rhel9 | — | — |
| openshift-pipelines | pipelines-cli-tkn-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-controller-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-watcher-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-webhook-rhel9 | — | — |
| openshift-pipelines | pipelines-resolvers-rhel9 | — | — |
| openshift-pipelines | pipelines-results-api-rhel9 | — | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
gRPC-Go up to 1.83.0 Transport transport.go heap-based overflow (Nessus ID 344999)
vuldb·2026-09-12·CVSS 8.7
CVE-2026-84304 [HIGH] gRPC-Go up to 1.83.0 Transport transport.go heap-based overflow (Nessus ID 344999)
A vulnerability has been found in gRPC-Go up to 1.83.0 and classified as problematic. The affected element is an unknown function of the file internal/transport/transport.go of the component Transport. The manipulation leads to heap-based buffer overflow.
This vulnerability is traded as CVE-2026-84304. It is possible to initiate the attack remotely. There is no exploit available.
The affected component should be upgraded.
GHSA
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
ghsa·2026-09-01
CVE-2026-84304 [HIGH] CWE-400 gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
### Impact
An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation.
Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS).
### Patches
The change to fix this issue is merged in `master`
Red Hat
google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation
vendor_redhat·2026-09-01·CVSS 8.7
CVE-2026-84304 [HIGH] CWE-770 google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation
google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
A flaw was found in gRPC-Go. This vulnerab
No detection rules found.
No public exploits indexed.
https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77https://github.com/grpc/grpc-go/pull/9331https://github.com/grpc/grpc-go/pull/9333https://github.com/grpc/grpc-go/releases/tag/v1.83.1https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc
2026-09-01
Published